2023-05-26 18:28:19 +00:00
|
|
|
|
|
|
|
|
# FAQ
|
|
|
|
|
|
|
|
|
|
## Retaining Client IPAddress
|
|
|
|
|
|
|
|
|
|
Please read [Retain Client IPAddress Guide here](./user-guide/retaining-client-ipaddress.md).
|
|
|
|
|
|
|
|
|
|
## Kubernetes v1.22 Migration
|
|
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
If you are using Ingress objects in your cluster (running Kubernetes older than
|
|
|
|
|
version 1.22), and you plan to upgrade your Kubernetes version to K8S 1.22 or
|
|
|
|
|
above, then please read [the migration guide here](./user-guide/k8s-122-migration.md).
|
2023-05-26 18:28:19 +00:00
|
|
|
|
|
|
|
|
## Validation Of __`path`__
|
|
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- For improving security and also following desired standards on Kubernetes API
|
|
|
|
|
spec, the next release, scheduled for v1.8.0, will include a new & optional
|
|
|
|
|
feature of validating the value for the key `ingress.spec.rules.http.paths.path`.
|
2023-05-26 18:28:19 +00:00
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- This behavior will be disabled by default on the 1.8.0 release and enabled by
|
|
|
|
|
default on the next breaking change release, set for 2.0.0.
|
2023-05-26 18:28:19 +00:00
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- When "`ingress.spec.rules.http.pathType=Exact`" or "`pathType=Prefix`", this
|
|
|
|
|
validation will limit the characters accepted on the field "`ingress.spec.rules.http.paths.path`",
|
|
|
|
|
to "`alphanumeric characters`", and `"/," "_," "-."` Also, in this case,
|
|
|
|
|
the path should start with `"/."`
|
2023-05-26 18:28:19 +00:00
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- When the ingress resource path contains other characters (like on rewrite
|
|
|
|
|
configurations), the pathType value should be "`ImplementationSpecific`".
|
2023-05-26 18:28:19 +00:00
|
|
|
|
|
|
|
|
- API Spec on pathType is documented [here](https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types)
|
|
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- When this option is enabled, the validation will happen on the Admission
|
|
|
|
|
Webhook. So if any new ingress object contains characters other than
|
|
|
|
|
alphanumeric characters, and, `"/,","_","-"`, in the `path` field, but
|
|
|
|
|
is not using `pathType` value as `ImplementationSpecific`, then the ingress
|
|
|
|
|
object will be denied admission.
|
2023-05-26 18:28:19 +00:00
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- The cluster admin should establish validation rules using mechanisms like
|
|
|
|
|
"`Open Policy Agent`", to validate that only authorized users can use
|
|
|
|
|
ImplementationSpecific pathType and that only the authorized characters can be
|
|
|
|
|
used. [The configmap value is here](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#strict-validate-path-type)
|
2023-05-26 18:28:19 +00:00
|
|
|
|
|
|
|
|
- A complete example of an Openpolicyagent gatekeeper rule is available [here](https://kubernetes.github.io/ingress-nginx/examples/openpolicyagent/)
|
|
|
|
|
|
2024-04-04 15:18:53 +00:00
|
|
|
- If you have any issues or concerns, please do one of the following:
|
|
|
|
|
- Open a GitHub issue
|
2023-05-26 18:28:19 +00:00
|
|
|
- Comment in our Dev Slack Channel
|
2024-04-04 15:18:53 +00:00
|
|
|
- Open a thread in our Google Group <ingress-nginx-dev@kubernetes.io>
|
|
|
|
|
|
|
|
|
|
## Why is chunking not working since controller v1.10 ?
|
|
|
|
|
|
|
|
|
|
- If your code is setting the HTTP header `"Transfer-Encoding: chunked"` and
|
|
|
|
|
the controller log messages show an error about duplicate header, it is
|
|
|
|
|
because of this change <http://hg.nginx.org/nginx/rev/2bf7792c262e>
|
|
|
|
|
|
|
|
|
|
- More details are available in this issue <https://github.com/kubernetes/ingress-nginx/issues/11162>
|
